Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 974 of 1013.
- CVE-2026-104714 Apache Struts: Shared message formatter exposes date and time values across concurrent requests
- CVE-2026-104713 Apache Struts: Unbounded request body read in the REST plugin
- CVE-2026-104712 Apache Struts: Disproportionate response size when rendering BigDecimal request parameters
- CVE-2026-104711 Apache Struts: OGNL injection in the legacy RESTful action mapper
- CVE-2026-104706 Mitel MiVoice Office 400 view system files path traversal
- CVE-2026-104704 Cleartext Transmission of Sensitive Information in hMailServer
- CVE-2026-1047 salavat counter Plugin <= 0.9.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'image_url' Parameter
- CVE-2026-104694 Thrive Automator < 11.2 - Editor+ Blind SQLi via 'additional' Parameter
- CVE-2026-104684 Envira Gallery < 1.16.2 - Author+ IDOR via Shortcode
- CVE-2026-104682 Envira Gallery < 1.16.2 - Contributor Missing Authorization via Convert Gallery REST Route
- CVE-2026-104681 Envira Gallery < 1.16.2 - Author+ Non-Public Post Title and Excerpt Disclosure via Gallery REST Field
- CVE-2026-104680 Envira Gallery < 1.16.2 - Multisite Subsite Admin+ Arbitrary Plugin Installation via Onboarding Wizard
- CVE-2026-104679 XML external entity in VOCALOID6 Editor
- CVE-2026-104678 CP Media Player < 1.3.4 - Contributor+ Media Player Settings Update
- CVE-2026-104677 WP Coder 4.0 - 4.5.1 - Editor+ RCE via Global PHP
- CVE-2026-104675 WordPress Event Tickets plugin <= 5.30.0 - Broken Access Control vulnerability
- CVE-2026-104673 Cross-site scripting in MP3 Audio Player for Music, Radio & Podcast by Sonaar
- CVE-2026-104672 WordPress GiveWP plugin <= 4.17.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-104671 TutorStarter < 4.0.4 - Unauthenticated User Registration Bypass via AJAX
- CVE-2026-104670 WordPress LearnPress plugin <= 4.4.9 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-104667 Animated Number Counters < 3.1 - Editor+ Second-Order SQLi via Counter Order
- CVE-2026-104661 Incorrect Privilege Assignment in GitLab
- CVE-2026-104660 Missing Authorization in hMailServer
- CVE-2026-104659 Origin Validation Error in hMailServer
- CVE-2026-104658 Reliance on Untrusted Inputs in a Security Decision in hMailServer
- CVE-2026-104653 Envira Gallery < 1.16.1 - Author+ Stored XSS via Gallery Crop Dimensions
- CVE-2026-104652 Envira Gallery < 1.16.1 - Author+ Stored XSS via Gallery Image ID
- CVE-2026-104651 Yaad Sarig Payment Gateway For WC < 2.2.13 - Subscriber+ Arbitrary Order Payment Manipulation via IDOR
- CVE-2026-104646 Image Photo Gallery Final Tiles Grid < 3.6.14 - Contributor+ Stored XSS via Gallery Shortcode Attributes
- CVE-2026-104645 Missing authorization in Image Photo Gallery Final Tiles Grid
- CVE-2026-104644 Image Photo Gallery Final Tiles Grid < 3.6.15 - Contributor+ Stored XSS via Gallery Configuration Update
- CVE-2026-104643 Easy HTTPS Redirection (SSL) < 2.0.2 - Subscriber+ Scan Result Disclosure and Site-Wide URL Rewrite
- CVE-2026-104642 Simple Shopping Cart 5.1.3 - 5.3.2 - Contributor+ Price Manipulation via Price Verification Bypass
- CVE-2026-104641 Simple Shopping Cart < 5.3.3 - Unauthenticated Payment Bypass via Unverified PayPal IPN Recipient
- CVE-2026-104638 onetwothreeneth HospitalManagementSystem sessions.php improper authentication
- CVE-2026-104637 onetwothreeneth HospitalManagementSystem controller.php edit_patient unrestricted upload
- CVE-2026-104636 Gitea SSRF through Git HTTP redirects in mirrors and fetches
- CVE-2026-104635 Uncontrolled recursion in elixir-protobuf/protobuf JSON decoding of self-referential messages
- CVE-2026-104634 beam_mcp: JSON boolean and null tool arguments reach dispatch as strings
- CVE-2026-104633 Gitea migration memory exhaustion from zero page size
- CVE-2026-104632 Gitea fork workflow approval bypass through cancel and rerun
- CVE-2026-104629 Grid Protection Alliance openPDC and openHistorian Use of Externally-Controlled Input to Select Classes or Code
- CVE-2026-104628 Satel Netco Design Inefficient Regular Expression Complexity
- CVE-2026-104627 Gitea OpenID account linking without session binding
- CVE-2026-104626 Gitea fork workflow job revival through later approval
- CVE-2026-104625 CodeAstro Simple Loan Management System index.php sql injection
- CVE-2026-104618 sdbootutil: world-readable debug log
- CVE-2026-104617 sdbootutil: qrencode invocation leaks PIN/recovery key in /proc/<pid>/cmdline
- CVE-2026-104614 CodeAstro Simple Pharmacy Management System delete.php sql injection
- CVE-2026-104613 CodeAstro Simple Pharmacy Management System view.php sql injection
- CVE-2026-104612 SourceCodester Student Result Management System Announcement new_announcement.php cross site scripting
- CVE-2026-104611 Tenda AC9 POST Request fast_setting_internet_set stack-based overflow
- CVE-2026-104610 Tenda HG7/HG9/HG10 Boa Web Server formLoopBack boaGetVar stack-based overflow
- CVE-2026-104609 onetwothreeneth HospitalManagementSystem edit_accounts.php get sql injection
- CVE-2026-104606 itsourcecode Online Admission System Project confirm.php sql injection
- CVE-2026-1046 Arbitrary application execution via unvalidated server-controlled URLs in Help menu
- CVE-2026-104598 libosmo-sigtran through 2.2.1 contains an out-of-bounds read in the M3UA NOTIFY decoder in src/m3ua.c.
- CVE-2026-104597 libosmocore through 1.14.1 contains an out-of-bounds read in iuup_rx_initialization() in src/gsm/iuup.c.
- CVE-2026-104596 libosmocore through 1.14.1 contains out-of-bounds reads in the GSM 04.80 supplementary-service component parsers in src/gsm/gsm0480.c.
- CVE-2026-104594 libosmocore through 1.14.1 contains out-of-bounds reads in the IPA CCM identity-tag parsers in src/gsm/ipa.c.
- CVE-2026-104593 osmo-msc through 1.15.0 contains a stack-based buffer overflow in decode_mme_name() in src/libmsc/sgs_iface.c.
- CVE-2026-104592 libosmocore through 1.14.1 contains an out-of-bounds read in the CBSP WRITE-REPLACE decoder in src/gsm/cbsp.c.
- CVE-2026-104591 libosmocore through 1.14.1 contains a buffer overflow in osmo_iuup_compute_payload_crc() in src/gsm/iuup.c.
- CVE-2026-104587 blob42 gosuki through commit 6e2bf34 contains a Stored Cross-Site Scripting (XSS) vulnerability.
- CVE-2026-104586 AUTOM8N (WHM/cPanel plugin) through commit 82821f7 contains an OS Command Injection in borg_restore.cgi.
- CVE-2026-104585 Mobile Security Framework (MobSF) v4.5.2 is vulnerable to Command Injection in /download_data/, /api/v1/scan, Dynamic Analyzer ADB integration module.
- CVE-2026-104584 reNgine up to v2.2.0 and current master branch (commit de4199222cca5618f1255930ce78987e47d43a99) is vulnerable to OS Command Injection via t
- CVE-2026-1045 Cross-site scripting in Viet contact
- CVE-2026-104480 Improper MLS Welcome roster validation in Discord libdave allows unauthorized group membership
- CVE-2026-104479 Shopclass before 6.2.0 Stored XSS via Listing Description Field
- CVE-2026-104478 Formwork before 2.3.13 Path Traversal via BackupController Download and Delete
- CVE-2026-104477 Showdown through 2.1.0 XSS via unescaped quote in href and src attributes
- CVE-2026-104476 Backdrop CMS before 1.35.1 Information Disclosure via Configuration Export Archive
- CVE-2026-104475 IDURAR ERP CRM through 4.1.1 Stored XSS via SVG Upload
- CVE-2026-104474 OpenLiteSpeed before 1.9.3 Local Privilege Escalation via lsup.sh Auto-Update
- CVE-2026-104473 YesWiki before 4.5.3 Multiple Reflected XSS via BazaR and listpages
- CVE-2026-104472 YesWiki before 4.6.7 Missing Authorization via Attachment Download Handler
- CVE-2026-104471 YesWiki before 4.6.7 Unrestricted File Upload via Bazar CSV Import
- CVE-2026-104470 YesWiki before 4.6.7 SSRF via Bazar valeur Action url Parameter
- CVE-2026-104469 YesWiki before 4.6.7 Session Fixation via Login in AuthController.php
- CVE-2026-104468 YesWiki before 4.6.7 Non-Expiring Password Reset Tokens via LostPasswordAction
- CVE-2026-104467 YesWiki before 4.6.7 Authorization Bypass via Public API Mode
- CVE-2026-104466 YesWiki before 4.6.7 Stored XSS via Wakka Markdown Image src Attribute
- CVE-2026-104465 YesWiki before 4.6.7 Reflected XSS via field Parameter in mail Handler
- CVE-2026-104464 YesWiki before 4.6.7 SSRF via Bazar abonnements sync actor parameter
- CVE-2026-104463 YesWiki before 4.6.7 Unauthenticated SSRF via ActivityPub Inbox
- CVE-2026-104462 YesWiki before 4.6.7 SQL Injection via nuagetag tags parameter
- CVE-2026-104461 YesWiki before 4.6.7 Stored XSS via Unsanitized SVG Upload in Bazar FileField
- CVE-2026-104460 YesWiki before 4.6.7 Unauthenticated Blind SQL Injection via newtextsearch
- CVE-2026-104459 YesWiki before 4.6.7 SSRF via ActivityPub WebFinger actor_handle
- CVE-2026-104458 YesWiki before 4.6.7 SSRF Guard Bypass via IPv6 Transition Addresses
- CVE-2026-104457 YesWiki before 4.6.7 SQL Injection via filtertags filterN parameter
- CVE-2026-104456 YesWiki before 4.6.7 Second-Order SQL Injection via ACL Username
- CVE-2026-104455 YesWiki before 4.6.7 Read-ACL Bypass via recentchangesrssplus RSS Action
- CVE-2026-104454 YesWiki before 4.6.7 ReDoS via wakka.php Edit-Preview Endpoint
- CVE-2026-104453 YesWiki before 4.6.7 CSRF Tag Deletion via admintag Action
- CVE-2026-104452 YesWiki before 4.6.7 CSRF Attachment Deletion via filemanager Handler
- CVE-2026-104451 YesWiki before 4.6.7 CSRF Page Revision Restore via RevisionsHandler
- CVE-2026-104450 YesWiki before 4.6.7 ACL Bypass and Stored XSS via pointimage Action
- CVE-2026-104449 YesWiki before 4.6.7 Unauthenticated Page Overwrite via Bazar id_fiche